Medium severity · published Oct 30, 2026
CVE-2026-119424
OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity
New
6.8
CVSS
–
EPSS
No
On KEV
Description
OPNsense core before 26.7.8 contains a configuration line injection vulnerability that allows authenticated users with wireless-edit privilege to inject directives by embedding CR/LF characters in WPA fields. Attackers can place newlines in wpa.identity, wpa.passphrase, or RADIUS shared secrets to append arbitrary wpa_supplicant or hostapd directives loaded by root-run daemons.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
core · opnsense
before 26.7.8 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-119424
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-119424
patch
https://github.com/opnsense/core/commit/9f1eac0f9bdf705766ab61f9d62b9d55757fd0da
patch
https://github.com/opnsense/core/commit/3bbd714b4c4b60f164e2e908501f208d3eadf645
technical-description
https://github.com/opnsense/core/blob/26.7.7/src/opnsense/mvc/app/models/OPNsense/Interfaces/Wlan.xml#L185
technical-description
https://github.com/opnsense/core/blob/26.7.7/src/etc/inc/interfaces.inc#L1901
third-party-advisory
https://abraxaslabs.tech/research/opnsense-wlan-wpa-line
product
https://github.com/opnsense/core
More from core
9.9
CVE-2026-57155
OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer
9.1
CVE-2026-45158
OPNsense: Command Injection via Attacker-Controlled DHCP Config
9.1
CVE-2026-44194
OPNsense: RCE on user managment
9.1
CVE-2026-44193
OPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` method
9.0
CVE-2026-53581
ntp: write path traversal